CVE-2017-1000381

CWE-200 — Information ExposureCWE-125 — Out-of-bounds Read14 documents8 sources
Severity
7.5HIGH
EPSS
0.5%
top 33.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Nodejs Node.jsC-ares C-aresC-ares Project C-ares
Timeline
PublishedJul 7
Latest updateMay 17

Description

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶Debianc-ares< 1.12.0-4+3
▶NVDc-ares/c-ares5 versions+4
▶NVDnodejs/node.js4.2.0 — 4.8.4+6

🔴Vulnerability Details

4
GHSA
GHSA-vjr3-54h8-whpv: The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given inpu↗2022-05-17
▶
OSV
nodejs vulnerabilities↗2021-03-15
▶
OSV
CVE-2017-1000381: The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given inpu↗2017-07-07
▶
CVEList
CVE-2017-1000381: The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given inpu↗2017-07-07
▶

📋Vendor Advisories

4
Ubuntu
Node.js vulnerabilities↗2021-03-15
▶
Ubuntu
c-ares vulnerability↗2017-08-17
▶
Red Hat
c-ares: NAPTR parser out of bounds access↗2017-06-20
▶
Debian
CVE-2017-1000381: c-ares - The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR ...↗2017
▶

💬Community

5
Bugzilla
CVE-2017-1000381 mingw-c-ares: c-ares: NAPTR parser out of bounds access [epel-7]↗2017-06-20
▶
Bugzilla
CVE-2017-1000381 nodejs: c-ares: NAPTR parser out of bounds access [epel-all]↗2017-06-20
▶
Bugzilla
CVE-2017-1000381 c-ares: NAPTR parser out of bounds access↗2017-06-20
▶
Bugzilla
CVE-2017-1000381 nodejs: c-ares: NAPTR parser out of bounds access [fedora-all]↗2017-06-20
▶
Bugzilla
CVE-2017-1000381 mingw-c-ares: c-ares: NAPTR parser out of bounds access [fedora-all]↗2017-06-20
▶
CVE-2017-1000381 (HIGH CVSS 7.5) | The c-ares function `ares_parse_nap | cvebase.io